CSDDD: what the EU supply chain law means for suppliers

Friday afternoon. Your biggest customer’s head of procurement forwards a PDF: “Supplier code of conduct. Please sign by Monday.” You thought you were just supplying components.

With the CSDDD, there’s a question beyond employee counts and revenue thresholds: what does your customer want your business to promise in a contract? Here’s where the rules stand and how to review, negotiate, and track those requests.

What is the CSDDD?

The Corporate Sustainability Due Diligence Directive (CSDDD) is the EU directive on corporate due diligence for human rights and the environment, often called the EU supply chain law.

EU Directive 2024/1760 requires covered companies to identify risks, prevent harm, and act when violations occur. They need to examine the conditions in which their products are made and their business partners operate. A signed policy document doesn’t do that work for them.

The directive entered into force on July 25, 2024. That doesn’t mean it already applies to your company. Application begins in 2029.

What is the current status of the CSDDD after Omnibus I?

As of November 3, 2026, the Omnibus I changes mean the CSDDD covers fewer companies and applies later.

The changes appear in EU Directive 2026/470, published on February 26, 2026. EU companies must exceed both thresholds:

For companies outside the EU, the threshold is more than €1.5 billion in net revenue generated within the EU. Member states must transpose the directive into national law by July 26, 2028. It applies to covered companies from July 26, 2029.

Omnibus I also removes the uniform EU civil liability rule and the requirement for a climate transition plan. It provides for a risk-based approach and a cap on fines of 3% of worldwide net revenue.

When reviewing a contract, ask which current or future requirement your customer is referring to. “Because of the CSDDD” doesn’t explain every clause in the attachment.

Does the German Supply Chain Act still apply?

Yes, the German Supply Chain Due Diligence Act, or LkSG, still applies. Since 2024, it has covered companies with at least 1,000 employees in Germany under LkSG Section 1. This matters if you supply German customers.

Amendment bill 21/2474 would remove the reporting requirement and limit fines to serious violations. It was referred to committees on January 16, 2026, and hasn’t passed. The German parliament’s record still lists it as referred.

According to IHK Nord Westfalen (in German), BAFA, Germany’s enforcement authority, stopped reviewing LkSG reports in fall 2025. The due diligence duties remain. The governing coalition plans to replace the LkSG with legislation implementing the CSDDD. Until replacement legislation takes effect, the LkSG continues to apply.

Other EU countries must write the CSDDD into national law by July 26, 2028.

Have existing customer contracts reviewed before dropping agreed evidence requirements or deadlines because of a political announcement.

What is the difference between CSRD and CSDDD?

The CSRD requires sustainability reporting; the CSDDD requires due diligence on human rights and environmental risks in supply chains. Where a company falls under both, CSDDD reporting connects to the CSRD. When a customer questionnaire arrives, start here: does your customer need data for a report or to assess a specific risk?

Why does the CSDDD affect mid-size suppliers?

The CSDDD can reach mid-size suppliers through customer requirements, even though small and medium-sized enterprises (SMEs) aren’t directly covered by the directive.

That pattern is already visible under the German Supply Chain Act. In IHK Region Stuttgart’s findings from 2025, 33% of firms were indirectly affected SMEs, 12% were directly covered companies, and 55% weren’t affected.

Your customer needs to assess its supplier relationships and needs your cooperation. For direct suppliers, the LkSG explicitly provides for a contractual assurance that human rights and environmental expectations will be met, along with appropriate contractual monitoring mechanisms. These requirements appear in LkSG Section 6(4).

The CSDDD also requires covered companies to seek assurances from direct business partners that they will comply with the company’s code of conduct. Under the amended directive, the European Commission must adopt guidance on voluntary model contract clauses by July 26, 2027.

IfM Bonn’s findings show how much work this can create. One machinery manufacturer was having to complete around 90 pages per customer on supply chains and sustainability. The questions were similar but weren’t standardized. Each customer wanted its own version, adding to the workload. Picture that questionnaire arriving on Friday afternoon.

There is a limit on CSDDD information requests, though. The German government FAQ explains that covered companies may generally request information from business partners with fewer than 5,000 employees only when they cannot reasonably obtain it elsewhere.

Which clauses end up in your customer contracts?

Focus on codes of conduct, contractual assurances, information duties, audit rights, and the consequences of a breach. IHK Köln’s BAFA summary describes these forms of cooperation between covered companies and smaller suppliers.

Read the documents with these questions in mind:

• Supplier code of conduct: Which requirements must you meet, and which version becomes part of the contract? Check whether future changes would apply automatically.
• Contractual assurances: What are you promising for your own operations, and which requirements must you pass on to your suppliers? Watch for blanket guarantees about activities you cannot check or influence.
• Information requests and questionnaires: What must you provide, and when? Clarify the purpose, realistic response deadlines, and how confidential information will be handled.
• Audit and monitoring rights: Who may inspect which records or sites? Limit unrestricted access and agree on notice, confidentiality, frequency, and costs.
• Training: Who on your team must attend, and what evidence is required? Record who organizes it, pays for it, and allows for the working time.
• Corrective action and sanctions: What follows a confirmed violation, including possible suspension or termination? Review deadlines for correcting problems, liability terms, and any contractual penalties carefully.

Give wording such as “the supplier bears all costs” its own review if it appears in the draft. Establish which costs that actually means.

There’s also a limit on what customers can pass down. Covered companies cannot simply transfer their statutory due diligence duties to suppliers. The BAFA guidance says measures that clearly exceed an SME’s capabilities are inappropriate. A big customer logo doesn’t make a blanket demand reasonable.

How should suppliers handle CSDDD requirements?

Suppliers should collect customer requirements, define their limits, negotiate departures from those limits, and assign an owner and deadline to each agreed obligation.

Step 1: Collect customer contracts, codes, and questionnaires

Store framework agreements, amendments, signed codes of conduct, and completed questionnaires together. Assign each document to its customer and identify the current version. Review what you’ve already agreed to before signing the next code.

fynk’s Document hub gives these documents a central home. With AI search, you can search hundreds of contracts in plain language for references to codes of conduct, audits, or human rights. You don’t have to open each PDF separately.

Step 2: Set your red lines

Define what your business can accept: audits with advance notice, specific information duties, an agreed allocation of costs, and appropriate liability limits. Record who can approve exceptions. “Depends on the customer” is a thin review policy.

Contract playbooks turn those decisions into reusable rules. fynk’s AI review checks incoming customer contracts against your rules and flags departures with explanations and references to the relevant passages. You can prepare the open issues before the contract reaches legal.

Step 3: Negotiate before signing

Ask customers to explain broad demands and propose specific wording you can meet. Establish which sites an audit covers, what evidence is needed, and how confidential information will stay protected.

Match the scope to the actual risk and your capacity. The BAFA guidance emphasizes that the supplier’s capabilities must be considered. Discuss information requests in terms of their purpose rather than answering every question just in case.

With Redlining in fynk, your team and the other party work on a shared contract version. Suggested changes and comments stay with the relevant clause. That saves the search for the attachment where someone last changed the cost allocation.

Step 4: Pass appropriate requirements to your own suppliers

Check what you’ve promised to pass on. Use that commitment to define requirements for your own suppliers that fit their work and what they can influence. Use an agreed supplier code of conduct instead of forwarding every customer PDF without review.

When managing supplier contracts, make sure your supplier agreements match your customer commitments. In manufacturing, it helps to get specific: which requirement concerns which material, production step, or supplier?

With Document templates in fynk, you can reuse approved supplier clauses. Your team starts the next contract with terms you’ve already agreed internally.

Step 5: Track evidence and deadlines

Keep certificates, completed questionnaires, and training records with the relevant contract. Assign a responsible person and a deadline to every agreed follow-up task. Allow extra time when an answer depends on information from the production team.

Related files keep those records together with the contract in fynk. Tasks & reminders notify the responsible person before a supplier declaration or audit is due.

Step 6: Agree on internal approvals before signing

Have sales coordinate the customer commitment and procurement check which requirements your suppliers can meet. Your legal team reviews disputed wording; management decides on exceptions with significant cost or liability consequences. If you don’t have an in-house legal team, appoint someone responsible and get external advice when needed.

Approval workflows in fynk require the designated approvals before signing. A forwarded email saying “please sign by Monday” doesn’t replace an internal review.

Can a spreadsheet handle this?

A spreadsheet can give you an initial overview, but connecting contract versions, clause reviews, evidence, and approvals creates extra manual work.

A change makes sense when finding documents and chasing responses takes longer than reviewing the customer’s request.

What else do suppliers ask about the CSDDD?

Suppliers mainly want to know when the CSDDD applies, whether the LkSG remains in force, and what they must agree to when a customer asks.

• What does CSDDD stand for?

  CSDDD stands for Corporate Sustainability Due Diligence Directive. The EU supply chain directive sets corporate due diligence duties to protect human rights and the environment.

• When does the CSDDD apply?

  The directive entered into force on July 25, 2024. Under the Omnibus I amendments, member states must transpose it into national law by July 26, 2028. It applies to covered companies from July 26, 2029.

• Does the German Supply Chain Act still apply?

  Yes, the German LkSG still applies. According to the German parliament’s record, the amendment bill hasn’t passed. BAFA no longer reviews LkSG reports, but the due diligence duties remain, as IHK Nord Westfalen explains.

• Does an SME have to sign a customer's supplier code of conduct?

  The LkSG doesn’t impose a blanket duty on SMEs to sign every code presented to them. Covered customers cannot simply pass down their statutory duties, as IHK Köln’s BAFA summary explains. Review the code alongside your existing agreements and clarify disputed commitments before signing. This isn’t legal advice.

• Which companies are covered by the CSDDD?

  After Omnibus I, the CSDDD covers EU companies with more than 5,000 employees and more than €1.5 billion in worldwide net revenue, plus companies outside the EU with more than €1.5 billion in net revenue generated within the EU. SMEs may encounter requirements through their customers, according to the German government FAQ.